Privacy Policy

What we collect

• Account: your email address, your name and your profile picture. If you sign in with Google, Google gives us your email, name and picture.
• Profile and goals: birth date, sex, height, activity level, goal, target weight, calorie and macro targets, allergies, diet limits, foods you dislike, and your kitchen equipment. We use these to set your targets and to tailor the coach.
• Food and nutrition: your food log, meals, saved foods, recipes, meal plans, shopping lists and pantry.
• Weight and body: weigh ins and body measurements, from you or from Withings if you connect it.
• Body scan photos: private photos you take to track your progress. Only you can see them.
• Training: workouts, sets, weights, personal records and splits.
• Health Connect data, only if you allow it: see the Health Connect section below.
• Photos: recipe photos, cooking photos and your profile picture. Photos you take of a plate, a menu or a food label go to our AI provider to be read, and we keep only the result, not the photo.
• Feedback: the message you send us, with the app version and the Android version.
• Usage records: for each AI feature you use, we record which feature, how many tokens and the cost. These records hold no text, photos or health data.
• Error reports: when our server hits an error, the report can include your user id.
• Product analytics: when you import a recipe, our server records one event with your user id, so we can see how well imports work.
• Device id for barcode scans: the barcode scanner uses Google ML Kit on your phone. ML Kit sends Google device and app information and an id for this install, to measure how ML Kit performs.

We do not collect your location, your contacts or an advertising id. The app has no ads.

Voice commands

In cook mode you can move between steps by voice. Android sends your voice to the Google speech service to turn it into text. We do not record or store your voice.

Health Connect

If you allow it, NomyNoms reads these records from Health Connect on your phone: steps, active calories burned, sleep sessions, heart rate variability, resting heart rate, and exercise sessions. It can also write your finished workouts to Health Connect as exercise sessions.

The AI coach uses this data to answer questions about your day, your calories, your training and your recovery.

Each night, our server also builds a short summary of each day: your sleep, heart rate variability, resting heart rate, steps, active calories and workouts, together with your food log and weight. It sends that day to Anthropic, which writes the summary. The coach uses these summaries to answer questions about your past days. This runs on its own, without you opening the app.

We keep the raw records from Health Connect for 90 days. We keep the daily totals and the daily summaries until you delete your account.

We do not sell Health Connect data, use it for ads, or share it with anyone except the service providers named in this policy, who process it only to run NomyNoms. Use of information received from Health Connect follows the Health Connect Permissions policy, including the Limited Use requirements.

You can turn off access at any time in Health Connect on your phone. To delete what we already copied, delete your account (see Deleting your account).

How we use your data

• To run the app: plan meals, log food and workouts, track weight, and keep your data in sync.
• To power the AI features you use: the coach, recipe import, nutrition estimates, plate, menu and label scans, workout ideas and the weekly recap.
• To send email you asked for, and to answer your feedback.
• To see how well features such as recipe import work, so we can improve them.
• To keep the service secure and fix errors.

We do not sell your data. We do not use it for ads. We do not use it to train AI models, and Anthropic does not train its models on data sent through its business API.

Who processes your data

These companies process data for us, only to run NomyNoms. The full list is at nomynoms.com/subprocessors.

• Supabase: our database, sign in and photo storage.
• Vercel: hosts our server and website. Its logs can hold your user id.
• Anthropic: runs the AI features. It receives what each feature needs, such as your question and your recent food, weight and training for the coach, a recipe page for an import, or a photo for a scan. It also receives the nightly day summary described in the Health Connect section.
• Voyage AI: turns recipe text and exercise searches into a search index.
• Google: sign in with Google, the speech service for voice commands, ML Kit for barcode scans, and Android backup (see below).
• PostHog: product analytics for recipe imports.
• Withings: only if you connect it. We receive your weight and body measurements from Withings.
• Resend: sends our email. Your feedback reaches us by email with your name and email address.
• Upstash: short lived cache and rate limits.
• Sentry: server error reports.
• Instacart: only when you choose to send a shopping list there.

When you search for a food or scan a barcode, our server sends only the search words or the barcode to Open Food Facts and USDA FoodData Central, two public food databases. They never receive your name, your email or your user id.

Photos and links you share

Recipe photos, cooking photos and your profile picture are stored at web addresses that are hard to guess but are not secret. Anyone who has the address can open the photo. Body scan photos are private.

If you share a recipe or a list, anyone with the link can see what you shared.

Data on your phone

The app keeps a copy of your recent data on your phone, so it works offline. Your coach chat stays on your phone only and clears each night. If Android backup is on, Android can back up this app data to your Google account.

The closed test sign up

If you join the closed test on our website, we keep the email you give us only to send you the Google Play invite. We delete it when the test ends.

How long we keep it

We keep your data until you delete it or delete your account. Raw Health Connect records are the exception: we delete them after 90 days. AI usage records are kept without any link to you after you delete your account.

Deleting your account

In the app: Settings, then Account, then Delete account. Without the app: email us. Both ways, and what we keep, are explained at nomynoms.com/delete-account.

Your choices and rights

• See and change your data in the app.
• Export your food log, weight and workouts from Settings.
• Turn off Health Connect or Withings at any time.
• Delete your account and your data.

Depending on where you live (for example the EU, the UK or California), you can also ask us for a copy of your data or ask us to correct it. Email hello@nomynoms.com and we will answer within 30 days.

Security

All data travels over encrypted connections. Our database rules let each account read only its own data. Connection tokens for Withings are encrypted. No system is perfectly secure, and we will tell you if a breach affects your data.

Children

NomyNoms is for adults (18 and over). We do not knowingly collect data from children. If you think a child has an account, email hello@nomynoms.com and we will delete it.

Changes to this policy

We will update this page when our practices change and change the date at the top. For a large change, we will also tell you in the app.

Contact

Questions about privacy: hello@nomynoms.com.